chore(security): zod 4 + nostrify 0.50 migration; audit 35 -> 13

- zod 3.25 -> 4.6.7 (only AppProvider uses zod; no zod-3-isms, zero TS changes).
- @nostrify/nostrify 0.47.1 -> 0.50.5, @nostrify/react 0.2.17 -> 0.2.31,
  @nostrify/types 0.36.9 (0.50 moved to zod 4; this clears the nostrify chain).
- npm audit fix applied the safe transitive fixes (react-router 6.30.6,
  dompurify 3.4.17, lodash 4.18.1, @modelcontextprotocol/sdk 1.32.2).
Remaining: dev-only vitest/tinypool (major), xlsx (no fix; write-only export),
react-router moderate (needs v7), build tooling (tailwind/postcss/capacitor-cli).
npm test green.

package.json

@@ -53,9 +53,9 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",
-    "@nostrify/nostrify": "^0.47.1",
-    "@nostrify/react": "^0.2.17",
-    "@nostrify/types": "^0.36.7",
+    "@nostrify/nostrify": "^0.50.5",
+    "@nostrify/react": "^0.2.31",
+    "@nostrify/types": "^0.36.9",
     "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-alert-dialog": "^1.1.1",
     "@radix-ui/react-aspect-ratio": "^1.1.0",
@@ -136,7 +136,7 @@
     "vaul": "^0.9.3",
     "websocket-ts": "^2.2.1",
     "xlsx": "^0.18.5",
-    "zod": "^3.25.71"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@capacitor/cli": "^8.4.2",